CVE-2021-40831: AWS IoT Device SDK v2 for Python - CA Pinning Bypass
Summary
CVE-2021-40831: The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Affects awsiotsdk versions < 1.7.0. Fixed in 1.7.0. How to fix ↓
Also tracked for
The same CVE-2021-40831 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS IoT Device SDK v2 for Python is a software development kit that enables developers to connect their devices to the AWS IoT Core service. It provides libraries and tools for building IoT applications using Python. The SDK allows devices to securely communicate with the AWS IoT Core service using the MQTT protocol.
Vulnerability Detail
The AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS is vulnerable to a CA pinning bypass. The SDK appends a user-supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. This behavior allows TLS handshakes to succeed if the peer can be verified either from the user-supplied CA or the system's default trust-store. Attackers with access to a host's trust stores or who can compromise a certificate authority already in the host's trust store can exploit this issue to bypass CA pinning. By spoofing the MQTT broker, an attacker could drop traffic, respond with their own data, but would not be able to forward this data to the MQTT broker without the user's private keys for authentication.
How To Fix
Minimum fixed version
1.7.0
This is the first release that contains the fix.
pip install --upgrade "awsiotsdk==1.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS is vulnerable to a CA pinning bypass. Users should upgrade to version 1.7.0 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for awsiotsdk →
FAQ
The vulnerability allows attackers with access to a host's trust stores or who can compromise a certificate authority to bypass CA pinning. This could lead to the spoofing of the MQTT broker and potential manipulation of data between the device and the broker.
No, this vulnerability requires the attacker to have access to the host's trust stores or the ability to compromise a certificate authority already in the trust store. It cannot be exploited remotely without prior access.
No, only versions prior to 1.7.0 on macOS are affected by this vulnerability. Users of other operating systems are not impacted.
No, there is no known workaround for this vulnerability. Users should upgrade to the fixed version of the SDK.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for awsiotsdk.
